marbl/Mash

Insufficient length checks

Closed this issue · 1 comments

The following code is confusing me.

Mash/src/mash/hash.cpp

Lines 14 to 24 in aabd592

#ifdef ARCH_32
char data[use64 ? 8 : 4];
MurmurHash3_x86_32(seq, length > 16 ? 16 : length, seed, data);
if ( use64 )
{
MurmurHash3_x86_32(seq + 16, length - 16, seed, data + 4);
}
#else
char data[16];
MurmurHash3_x64_128(seq, length, seed, data);
#endif

On x86 there is a check that the length is sufficient, but only for 32bit hashes. For 64bit hashes, length - 16 may still be negative and lead to weird behaviour in MurmurHash3_x86_32. On x64 nothing gets checked. Am I missing something?

I realised that this might not be that much of an issue, because there are checks in place prior to calling this function that ensure enough data is available.